Unscored severity · published Jan 24, 2007
CVE-2007-0471
sre/params.php in the Integrity Clientless Security (ICS) component in Check Point Connectra NGX R62 3.x and earlier before Security Hotfix 5, and possibly VPN-1 NGX R62, allows…
–
CVSS
2.8%
EPSS
No
On KEV
Description
sre/params.php in the Integrity Clientless Security (ICS) component in Check Point Connectra NGX R62 3.x and earlier before Security Hotfix 5, and possibly VPN-1 NGX R62, allows remote attackers to bypass security requirements via a crafted Report parameter, which returns a valid ICSCookie authentication token.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CN
Connectra Ngx · Checkpoint
through r62 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-0471
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-0471
Exploit
http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051920.html
osvdb.org
http://osvdb.org/31655
Vendor Advisory
http://secunia.com/advisories/23847
secureknowledge.checkpoint.com
http://secureknowledge.checkpoint.com/SecureKnowledge/viewSolutionDocument.do?lid=sk32472
securityreason.com
http://securityreason.com/securityalert/2179
securitytracker.com
http://securitytracker.com/id?1017559
More from Connectra Ngx
–
CVE-2011-1827
Multiple unspecified vulnerabilities in Check Point SSL Network Extender (SNX), SecureWorkSpace, and Endpoint Security On-Demand, as distributed by SecurePlatform, IPSO6,…
–
CVE-2008-5994
Cross-site scripting (XSS) vulnerability in index.php in Check Point Connectra NGX R62 HFA_01 allows remote attackers to inject arbitrary web script or HTML via the dir parameter
–
CVE-2005-2889
Check Point NGX R60 does not properly verify packets against the predefined service group "CIFS" rule, which allows remote attackers to bypass intended restrictions